I'd like to encrypt files and their metadata as well. They will be stored in some sort of database (not yet decided, probably pgsql). The metadata can be for example the creation time, the modification time, etc, so it is well guessable e.g. a datetime string or a timestamp. Afaik this makes finding the key with brute force easier. Since there will be many files encrypted with the same key, I was wondering what algorithm might be the best to encrypt the files and the metadata?

I was thinking on workarounds too, for example storing the datetime string in a JSON format along with a random value:

    modificationTime: "2017-11-18 03:54:11",
    bik2rbfih2ofbskblwbf: "sdfgjhln2rh9328hogolwesgn"

Following this line of thought I could add the whole metadata to a single column, so it would be even harder to guess, but on the other hand harder to query too.

    label: "blah",
    description: "blah blah",
    tags: [1,2,3,4,5],
    modificationTime: "2017-11-18 05:21:11",
    creationTime: "2017-11-18 03:54:11",
    sfbik2rbfih2ofbskblwbf: "sdfgjhln2rh9328hogolwesgn"

Another thought was to encrypt the metadata and the actual data with different keys. Any suggestions, best practices in the topic?

1 Answer 1


Short answer: Any modern considered-secure symmetric cipher is fine. Just use AES with a secure mode of operation, like CBC or GCM.

Known plaintext attacks are a standard part of cryptanalysis; any cipher that is even marginally weaker against them than otherwise is considered cryptographically compromised.

Longer answer: This is an excellent risk to consider, but you're kind of asking the wrong question. Leaving aside the why (that is, why are you trying to roll your own data encryption scheme, when so many already exist?), you should probably consider where the assumption that

this makes finding the key with brute force easier

comes from. Even if you HMAC the data with a different key (not possible if using an authenticated encryption scheme like AES-GCM), if you have any way to determine a correct key from an incorrect one (such as a hash of the key, or of the plaintext, or even just because you make the assumption that if it decrypts into syntactically-valid JSON the key is probably right), an attacker can do the same thing. Being able to near-instantly validate the correctness of the correct key is just assumed to always be the case.

The difficulty of brute-forcing modern crypto isn't because you don't have a partial plaintext in systems that use it, or because it's hard to know when you've guessed the right key. It's because the key space is so large that, if you built an entire datacenter full of top-of-the-line hardware that did nothing but try a distributed attack to brute-force a single 128-bit AES key and could run forever, the machines in that datacenter would be absurdly unlikely to guess the right key before the sun expanded to swallow the earth.

That's not hyperbole, by the way; human intuition is just really bad at big numbers, and 2^128 is an extremely big number. Let's say you put a million (OK, 2^20) CPUs in the hardware in that datacenter. Let's further assume that each of them can check 32 billion (2^35) possible keys per second (which is faster than even the best hardware-accelerated modern commodity CPUs I'm aware of, but you've got some fancy custom hardware). That means your whole datacenter can check 2^55 (about 32 quadrillion) possible keys per second. Super fast, right? At that rate, and assuming that on average you only have to search half of the keyspace, you will need (2^127)/(2^45) = 2^82 seconds to have a 50% chance of finding the key.

The sun is expected to swallow the earth in roughly 7.6 billion years (give or take a few thousand millennia). In seconds, that's 2.4x10^17, also written as 2.4e17. Take the base 2 logarithm of that number, and you get a bit less than 58. 2^82 / 2^58 is 2^24, or about 16 million. You would be roughly one six-millionth of a percent of the way done.

Also, not part of your question, but: you are taking into account integrity (detecting tampering with the ciphertext, which most encryption provides little if any protection against) and also generating unique initialization vectors for your files, right? Doing crypto right is hard. There's already (tons of) programs out there that do symmetric encryption of files (or other data blobs).

  • "Since there will be many files encrypted with the same key," one thing you want to remember is unique IVs for each entry to keep bad things from happening ie if the first block of two of your messages are the same, then the cipher text will be as well, just something to keep in mind
    – ronman38
    Commented Nov 18, 2017 at 6:27
  • You are right, but what would I learn from using an existing solution?! :D
    – inf3rno
    Commented Nov 18, 2017 at 9:46
  • @ronman38 I do mention (in the bottom paragraph) the need for unique initialization vectors (IVs). There are other areas of concern, too (key generation, block cipher padding, etc.) but yes, IVs are definitely an important area to get right when working with large numbers of messages (files) encrypted via a single key.
    – CBHacking
    Commented Nov 19, 2017 at 2:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .